Bayview Medical Center says a staff member put a spreadsheet of 3,182 patients' details into a public AI tool. Here is who is affected and what to do.
Bayview Medical Center in Maryland, part of Johns Hopkins Medicine, says a staff member mistakenly uploaded a spreadsheet with details on 3,182 patients to a public AI tool the hospital had not approved. Letters to affected patients went out from 22 October.
On 21 September, during an internal review, a staff member uploaded the file. The hospital learned of it the same day. The patient letters came 31 days later. Bayview has not named the tool or the company behind it. WMAR-2 News in Baltimore broke the story. The description sounds like a chatbot anyone can open in a web browser, but that is a reading of the wording, not a fact from the hospital.
The spreadsheet covered patients admitted and treated from May to September 2026. It may have included names, admission and treatment dates, medical record and account numbers, department, medications given and doctors' names. The hospital says it did not include Social Security numbers or financial data. "May have included" means this is what the file could contain, not proof that anyone read it.
The missing Social Security number is good news. It is the number that opens the door to identity theft. The rest is still personal. A name next to a record number, a department and a list of drugs shows that a person was treated in a certain place with certain therapies. That is a privacy problem more than a money problem.
Bayview had the staff member delete the prompt, the conversation and the document from the tool's history. It asked the company that owns the tool to remove the data from its systems and opened an investigation. It also says it is tightening rules and training. Patients get 12 months of free credit monitoring through Experian IdentityWorks and a toll-free number for questions.
Deleting a chat from your history does not necessarily erase it from the company's servers, as Straight Arrow News points out. A tool may keep data for its own period. Because Bayview has not named the company, it is unclear which rules apply.
The steps in the box above cover what patients and workplaces should do. The bigger lesson is for any business. Johns Hopkins' AI guidelines already said, as of May 2025, not to enter clinical or non-public data into unapproved tools. The rule existed and the mistake happened anyway. The hospital has not said whether technical controls could have blocked the upload. A written rule alone did not hold.
Under HIPAA, the US health privacy law, an improper disclosure of patient data is presumed to be a breach unless a risk assessment shows a low chance it was compromised. For a business, a quick paste into a chatbot can count as a leak.
Never paste client or patient details into a public AI tool, and give staff an approved option so they are not tempted.
A tax law firm warns that 2026 tax scams use fake numbers, copycat websites and AI voices, and that a rushed demand for money is the biggest warning sign.
Read more: How to spot a tax scam before you send money or personal detailsReports say the Trump administration is weighing underwater datacenters off Maine and Alaska, and Lake Erie groups want a plan before anyone proposes one nearby.
Read more: Underwater datacenters may be next, and Lake Erie groups are worriedA federal judge says Delta must face a proposed class action over window seat fees, a case that could cost the airline millions and affects anyone who pays extra for a seat.
Read more: Judge says Delta must face class action over window seat fees
